Commit 68eb3db0 authored by Jan Kara's avatar Jan Kara
Browse files

ext3: Fix data / filesystem corruption when write fails to copy data 



When ext3_write_begin fails after allocating some blocks or
generic_perform_write fails to copy data to write, we truncate blocks already
instantiated beyond i_size. Although these blocks were never inside i_size, we
have to truncate pagecache of these blocks so that corresponding buffers get
unmapped. Otherwise subsequent __block_prepare_write (called because we are
retrying the write) will find the buffers mapped, not call ->get_block, and
thus the page will be backed by already freed blocks leading to filesystem and
data corruption.

Reported-by: default avatarJames Y Knight <foom@fuhm.net>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 5a20bdfc

fs/ext3/inode.c

+14 −4
Original line number Diff line number Diff line
@@ -1151,6 +1151,16 @@ static int do_journal_get_write_access(handle_t *handle, 
	return ext3_journal_get_write_access(handle, bh);

}



/*

 * Truncate blocks that were not used by write. We have to truncate the

 * pagecache as well so that corresponding buffers get properly unmapped.

 */

static void ext3_truncate_failed_write(struct inode *inode)

{

	truncate_inode_pages(inode->i_mapping, inode->i_size);

	ext3_truncate(inode);

}



static int ext3_write_begin(struct file *file, struct address_space *mapping,

				loff_t pos, unsigned len, unsigned flags,

				struct page **pagep, void **fsdata)
@@ -1209,7 +1219,7 @@ write_begin_failed: 
		unlock_page(page);

		page_cache_release(page);

		if (pos + len > inode->i_size)

			ext3_truncate(inode);

			ext3_truncate_failed_write(inode);

	}

	if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))

		goto retry;
@@ -1304,7 +1314,7 @@ static int ext3_ordered_write_end(struct file *file, 
	page_cache_release(page);



	if (pos + len > inode->i_size)

		ext3_truncate(inode);

		ext3_truncate_failed_write(inode);

	return ret ? ret : copied;

}
@@ -1330,7 +1340,7 @@ static int ext3_writeback_write_end(struct file *file, 
	page_cache_release(page);



	if (pos + len > inode->i_size)

		ext3_truncate(inode);

		ext3_truncate_failed_write(inode);

	return ret ? ret : copied;

}
@@ -1383,7 +1393,7 @@ static int ext3_journalled_write_end(struct file *file, 
	page_cache_release(page);



	if (pos + len > inode->i_size)

		ext3_truncate(inode);

		ext3_truncate_failed_write(inode);

	return ret ? ret : copied;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE